Security & ComplianceLast updated: 2026-05-04

Security and compliance are top priorities for us because they are fundamental to your experience with our products. We are committed to securing your application's data, eliminating systems vulnerability, and ensuring continuity of access.

We use a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All our employees undergo background checks before employment and are trained on security practices during company onboarding and on an annual basis.

Infrastructure and Network Security

Physical Access Control

Our platform is hosted on Amazon Web Services (AWS). Amazon data centers feature a layered security model, including extensive safeguards such as:

• Custom-designed electronic access cards
• Alarms
• Vehicle access barriers
• Perimeter fencing
• Metal detectors
• Biometrics

Our employees do not have physical access to Amazon data centers, servers, network equipment, or storage.

Logical Access Control

We are the assigned administrator of our own infrastructure on AWS, and only designated authorized operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Penetration Testing

We undergo annual penetration testing conducted by an independent, third-party agency. For testing, we provide the agency with an isolated clone of our platform and a high-level diagram of application architecture. No customer data is exposed to the agency through penetration testing.

Information about any security vulnerabilities successfully exploited through penetration testing is used to set mitigation and remediation priorities. A summary of penetration test findings is available to customers upon request.

Third-Party Audit

AWS undergoes various third-party independent audits regularly and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited to, the SSAE 18-compliant SOC 2 certification and ISO 27001 certification.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among our most significant concerns for infrastructure hosting and management. AWS intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

We do not provide direct access to security event forensics, except to the engineering and customer support teams, exclusively on an as-needed basis during downtime and attacks.

Business Continuity and Disaster Recovery

High Availability

Every part of our service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.

Business Continuity

We keep hourly encrypted backups of data in multiple regions on AWS. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, we will bring up a duplicate environment in a different AWS region. Our operations team has extensive experience performing full region migrations.

Data Security and Privacy

Data Encryption

All data in our servers is encrypted at rest. AWS stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

We exclusively send data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Retention

We retain customer data in production indefinitely for the duration of the subscription, and for a minimum of 90 days after termination of the subscription by default. We create regular backups of event data in production. We delete backups within 90 days after creation.

Data Removal

When a customer terminates their subscription and deletes their account by selecting the option in their account settings, all data stored in the account becomes inaccessible to the customer within 24 hours. The data associated with the account will be deleted from our servers upon the expiration of the retention period set forth in "Data Retention" above. Data can also be deleted upon request and via our REST API.

PII Handling

We take the handling of personally identifiable information (PII) seriously. Domain registration data, including WHOIS contact information processed through Ingram Domains, is treated with the highest level of care and is subject to our data encryption, retention, and removal policies. Note that registry rules may require certain WHOIS fields to remain publicly accessible for the lifetime of the registration, regardless of our internal retention.

Application Security

Multi-Factor Authentication

In addition to password login, multi-factor authentication (MFA) provides an added layer of security. We encourage MFA as an important step towards securing data access from intruders. Our users can deploy universal second-factor devices like passkeys or time-based one-time password (TOTP) apps such as Google Authenticator as additional factors. This also applies to sign-in with an SSO provider.

REST API Authentication

Our REST API uses an authentication token for authentication. Authentication tokens are passed using the Authorization header and are used to authenticate a user account with the API.

Email Security

Our service includes email notifications. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams.

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All our customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.

In the audit log, all of the actions by user and event within the platform are listed chronologically by time so you'll always have a view into your account's most recent history.

Secure Application Development (Application Development Lifecycle)

We practice continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities.

Corporate Security

Malware Protection

We believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations are enrolled in Mobile Device Management (MDM) and Endpoint Detection and Response (EDR) solutions to enforce security settings including full-disk encryption, screen lock, and OS updates.

Risk Management

We follow the risk management procedures outlined in NIST SP 800-30, which include nine steps for risk assessment and seven steps for risk mitigation.

All our product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on our operations team have direct access to production servers.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

Contingency Planning

Our operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.

Security Policies

We maintain an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps. An overview of specific security policies is available upon request:

• Access Management
• Change Management
• Data Request
• Data Management
• Information Security
• Incident Response
• Policy Management and Maintenance
• Risk Management
• Vendor Management
• Vulnerability Management

Background Checks

We conduct background checks for all new hires, including identity verification, global watchlist checks and criminal records checks.

Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All employees additionally complete security training at least once a year. Policies presented to employees as part of the onboarding process are reviewed once a year to ensure we are keeping up with best practices.

Disclosure Policy

We follow the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. We notify our customers of any data breaches as soon as possible via email, followed by multiple periodic updates throughout each day addressing progress and impact.

Vulnerability Disclosure

We treat the security of customer data as a top priority. Despite our best efforts to write secure code and test thoroughly, vulnerabilities may still exist. We welcome reports from the security community and the public, and we will do our best to respond promptly to every legitimate report.

How to report

Send your report to security@ingram.tech. English is preferred. We will acknowledge receipt as soon as we reasonably can; please allow a few business days before following up.

A copy of this policy is published in machine-readable form at /.well-known/security.txt.

What to include

To help us triage and reproduce quickly, please include:

• A clear description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce, including any relevant URLs, accounts, or test data
• The platform, browser, or tooling used, with versions where relevant
• Supporting evidence such as logs, screenshots, request and response captures, or proof-of-concept code
• Your assessment of exploitability and impact
• Contact details we can use to reach you for follow-up questions

Please retain your evidence until we confirm the report is closed; we may need to revisit it during the investigation.

Rules of engagement

When testing our services, we ask that you:

• Comply with all applicable laws
• Limit testing to your own accounts or accounts you have explicit permission to access
• Avoid actions that could degrade service for other users (no denial-of-service, brute-force, or stress testing against production)
• Do not use social engineering, phishing, or physical attacks against our staff, contractors, customers, or vendors
• Do not access, modify, retain, or destroy data that does not belong to you; if you encounter customer data during testing, stop immediately and report it to us
• Avoid spam, mass-mailing, or any abuse of email or messaging features
• Give us a reasonable opportunity to remediate before disclosing the issue publicly

Safe harbor

We consider security research conducted in good faith and in accordance with this policy to be authorized. We will not pursue or support legal action against researchers who:

• Make a good-faith effort to follow these rules
• Report the issue to us promptly
• Avoid privacy violations, service disruption, and the destruction or exfiltration of data

If a third party initiates legal action against you for activity carried out in compliance with this policy, we will make our authorization known. If you are unsure whether a planned activity is in scope or compliant, contact us at security@ingram.tech before proceeding.

Out of scope

Some classes of report consume disproportionate triage time relative to their security impact, and we are unlikely to respond substantively unless you can demonstrate concrete exploitability against Ingram Domains:

• Findings already public, previously reported, or covered by an issue we have already addressed
• Reports that consist solely of automated scanner output, without analysis or proof of impact
• Missing or misconfigured HTTP security headers, cookie flags, or TLS cipher preferences, without a working exploit
• Issues that only affect outdated, unpatched, or end-of-life browsers, operating systems, or platforms
• Email-related findings such as missing SPF, DKIM, or DMARC records on domains that do not send mail, or theoretical open-relay claims without a working proof of concept
• Self-XSS, clickjacking on pages with no sensitive actions, or other findings requiring substantial user interaction with no realistic attack path
• Rate-limiting, account-enumeration, and CAPTCHA bypass reports without a demonstrated downstream impact
• Vulnerabilities in third-party services we depend on, such as our hosting, database, registry, or payment providers; please report those directly to the vendor in question
• Findings reproducible only against locally-run development builds or self-hosted forks

Confidentiality and credit

Treat any information you discover about our systems, our staff, or our customers as confidential. Do not share it publicly, with third parties, or with other researchers until we have remediated the issue and agreed on a disclosure timeline.

We will keep you informed as we work through the report. Once a fix is in place, you are welcome to publish your findings, and at your option we will credit you by name or handle in our security acknowledgments.

No bounty

This is not a paid bug bounty program. We do not offer monetary rewards, merchandise, or compensation for time and materials. We are grateful for the work the security community does, and we will happily acknowledge contributions publicly with your permission.

Other Resources

Compliance Certifications

We are currently working on obtaining the following compliance certifications:

• SOC 2 Type I and Type II
• ISO 27001

If your company requires a specific certification from this list, please contact us to discuss it.

Data Privacy

To ensure that personal data you send us is afforded the protections required by applicable data protection laws, we offer a Data Processing Addendum that incorporates our data privacy commitments. To request a DPA, please contact us.